🕵️ Chapter 13 — Intrusion Detection System (IDS) Cheat Sheet

🗺️ Big Picture

Who attacks? → Intruder Classes & Skill Levels
How do they attack? → Attack Lifecycle (6 phases)
How do we detect? → IDS Types + Detection Approaches
Where do we deploy? → Sensor Placement
What tools? → SNORT Rules + Honeypots
How do we measure? → FP / FN Evaluation

1. Classes of Intruders

APT = Advanced Persistent Threat

• Advanced = high skill, complex techniques
• Persistent = long-duration attack, stays hidden for months/years
• Examples: government-sponsored groups from China, USA, UK, and allies

2. Intruder Skill Levels

🍔 Analogy: Apprentice = orders off the menu. Journeyman = tweaks the recipe. Master = invents the dish from scratch.

Easiest to defend against: Apprentice (uses known tools → known signatures) Hardest to defend against: Master (zero-day discoveries, custom tools)

3. Attack Lifecycle (Intruder Behavior)

① Target Acquisition & Info Gathering
        ↓
② Initial Access
        ↓
③ Privilege Escalation
        ↓
④ Information Gathering / System Exploit
        ↓
⑤ Maintaining Access
        ↓
⑥ Covering Tracks

Each Phase in Detail

4. Key Definitions (RFC 2828)

$\boxed{\text{Security Intrusion} = \text{unauthorized access attempt (or success)}}$

$\boxed{\text{Intrusion Detection} = \text{monitor + analyze events} \rightarrow \text{real-time/near-real-time warning}}$

5. IDS — Core Concept

Core assumption: An intruder's behavior differs from a legitimate user's in detectable ways.

But there's always overlap between intruder and user profiles → causes:

• False Positives — normal behavior flagged as suspicious
• False Negatives — actual attack not detected

Three Logical Components of IDS

[Sensors] → collect data (traffic, system calls, logs)
    ↓
[Analyzers] → determine if intrusion occurred
    ↓
[User Interface] → view output / control system

6. IDS Types

📷 Analogy:

• HIDS = CCTV inside a room (watching one host)
• NIDS = CCTV at the corridor junction (watching all traffic passing)
• Distributed = both cameras + a security room that correlates all footage

7. Why IDS Matters (3 Reasons)

1. Detect + eject intruders quickly before damage occurs
2. Acts as a deterrent — discourages attacks
3. Collects attack intelligence — strengthens future defenses

8. IDS Requirements

9. Detection Approaches

Approach 1 — Anomaly Detection

• Builds a baseline of normal user/system behavior over time
• Flags significant deviations from baseline
• Can detect: zero-day attacks, insider threats, unknown malware

💳 Analogy: Like a bank that knows your spending habits. If your card suddenly gets used overseas at 3 AM → auto-blocked. It doesn't need to know the exact fraud type — it just knows it's unusual.

Sub-approaches:

Anomaly Detection Example:

IDS learns: john logs in 9am–5pm, uses vim/firefox, never touches /etc/passwd
→ Suddenly: john runs bash → sudo cp /etc/shadow /tmp/
→ IDS flags: unexpected sudo + outside normal hours + sensitive file access 🚨

Real-World Tools

Approach 2 — Signature / Heuristic Detection

• Matches known malicious patterns against traffic or system data
• Must be specific enough to minimize false alarms
• Widely used in anti-virus, traffic proxies, NIDS

Rule-Based Heuristic

• Uses rules based on known exploits or known weaknesses
• Can also flag suspicious behavior within normal patterns
• SNORT = prime example

🛡️ Analogy: Like a spam filter — it knows what spam patterns look like. But it cannot detect brand-new spam it's never seen before.

Anomaly vs. Signature — Comparison

📌 If forced to choose between FP and FN for IDS: prefer False Positive — better to flag a normal event for review than to miss a real attack.

10. Evaluation of IDS — FP & FN

✈️ Airport Analogy:

• False Positive = pulling an innocent passenger aside for screening
• False Negative = letting someone with a weapon walk through

$\boxed{\text{Goal: minimize both FP and FN — but FN is more dangerous}}$

11. IDS Placement — Before or After Firewall?

12. Host-Based IDS (HIDS)

• Installed on the host (server or endpoint)
• Can use anomaly or signature approach
• Primary purpose: detect intrusions, log suspicious events, send alerts
• Can detect both external and internal intrusions

HIDS Data Sources

• System call traces
• Audit / log file records
• File integrity checksums (detect tampered files)
• Registry access (Windows)

13. Distributed IDS Architecture

Three modules working together:

Agent Flow:

OS Audit Function
      ↓
Filter for Security-Relevant Events
      ↓
Reformat → Host Audit Record (HAR)
      ↓
Logic Module ←→ Templates
      ↓
Analysis Module ←→ Central Manager
      ↓ (Alerts sent up)

14. Network-Based IDS (NIDS)

• Monitors traffic at selected network points, packet by packet, in real/near-real time
• Examines: network / transport / application layer protocols
• Components: Sensors + Management Server(s) + Management Console(s)

NIDS Sensor Modes

🚦 Analogy:

• Inline = a guard standing at the gate — can physically stop you
• Passive = a CCTV camera — records everything but can't stop anyone

Deep Packet Inspection (DPI):

• Normal firewall checks only the packet header
• Inline NIDS with DPI checks the payload too
• To bypass DPI: encrypt the payload (e.g., HTTPS) → DPI can't read it

NIDS Sensor Deployment Positions

Internet
   ↓
External Firewall
   ↓ ← Sensor [2] — between internet and external firewall (sees raw traffic)
LAN Switch / Router ← Sensor [1] — between external FW and internal network
   ├── Service Network (Web, Mail, DNS)
   ├── Internal Servers ← Sensor [3] — catches lateral movement
   └── Workstation Networks ← Sensor [4] — catches endpoint attacks

Intrusion Detection Techniques by Attack Type

What NIDS Logs

• Timestamp, connection/session ID, event/alert type, severity
• Source/destination IP + ports
• Network/transport/application layer protocols
• Bytes transmitted, decoded payload, state info

15. Honeypots

Decoy systems — fake targets designed to:

• Lure attackers away from real systems
• Collect intelligence about attacker behavior and tools
• Keep attacker engaged → give admins time to respond

🪤 Analogy: A trap with bait — the burglar wastes time on a fake safe while you track them.

Key properties:

• Filled with fabricated (fake) data — legitimate users would never access it
• No production value → any incoming connection = likely probe/attack
• Outbound traffic from honeypot = system likely compromised

Honeypot Types

Honeypot Deployment Positions

16. SNORT

Open source, lightweight, configurable HIDS/NIDS

• Deployable on most nodes (host, server, router)
• Low memory + CPU usage
• Easily configured by sysadmins

SNORT Architecture

Packet → Packet Decoder → Detection Engine → Logger
                                           → Alerter

SNORT Rule Format

[Action] [Protocol] [Src IP] [Src Port] [Direction] [Dst IP] [Dst Port] ([Options])

Example:

alert tcp any any -> 192.168.1.0/24 80 (msg:"HTTP scan detected"; content:"GET"; nocase;)

Direction Operators

SNORT Rule Actions

Rule Options — 4 Categories

Key Option Details

IDS Rule Breakdown Example (Linux auditd)

-a always,exit -F arch=b64 -S execve -F exe=/usr/sbin/tcpdump -k sniffing

17. IETF IDS Standards (2007 RFCs)

🗂️ Summary Table

⚡ Key Facts to Remember